What causes "Impacts are is missing" in SonarSource/sonarqube?

Provide at least one valid impact, e.g. impacts=SECURITY>HIGH, when updating by impacts

SonarSource/sonarqube · error · IllegalArgumentException

Impacts are is missing

Error message

Impacts are is missing

What it means

RuleUpdater.updateImpactSeverityAndStandardSeverityIfTypeMatch requires the update to carry at least one impact severity; an empty impact map means the caller asked to update a rule by impacts but provided none, so an IllegalArgumentException (with a known typo, 'Impacts are is missing') is thrown.

Solutions

Provide at least one valid impact, e.g. impacts=SECURITY>HIGH, when updating by impacts
If you only want to change severity, pass the 'severity' parameter instead of 'impacts'
Verify the client is not dropping impact entries before sending the request (check request payload)

Example fix

// before
POST api/rules/update?key=java:S2076&impacts=
// after
POST api/rules/update?key=java:S2076&impacts=SECURITY>HIGH

Defensive patterns

Strategy: validation

Validate before calling

if (useImpacts && (!impacts || Object.keys(impacts).length === 0)) {
  throw new Error("Provide at least one impact (e.g. impacts=SECURITY>HIGH) or use 'severity' instead");
}

Type guard

function hasImpacts(params) {
  return typeof params.impacts === 'string' && params.impacts.includes('>');
}

Try / catch

try {
  await post("api/rules/update", params);
} catch (e) {
  if (String(e.message).includes("Impacts are is missing")) {
    params.impacts = "SECURITY>HIGH"; // or switch to severity param
    await post("api/rules/update", params);
  }
}

Prevention

Never send an empty impacts parameter; omit it or supply quality>severity pairs
Pick one update model per call: either severity or impacts
Inspect the outgoing request body in CI logs to confirm impacts entries are present

When it happens

Trigger: Calling api/rules/update with 'impacts' set but parsed to an empty map, or an internal RuleUpdate built without impact severities while the apply path still invokes the impact updater.

Common situations: Client sends impacts parameter as an empty string or empty list after parsing strips entries; template/custom rule update flows that pass an empty impacts map; API version mismatch where impacts parsing silently produces an empty map.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/12a272d1d0574dba. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/rule/RuleUpdater.java:147

    }
    // order is important -> sub-characteristic must be set
    if (update.isChangeDebtRemediationFunction()) {
      updateDebtRemediationFunction(update, rule);
    }
  }

  private static void updateImpactSeverity(RuleDto rule, String severity) {
    rule.getDefaultImpacts()
      .stream()
      .filter(i -> i.getSoftwareQuality() == ImpactMapper.convertToSoftwareQuality(RuleTypeMapper.toApiRuleType(rule.getEnumType())))
      .findFirst()
      .ifPresent(i -> i.setSeverity(mapImpactSeverity(severity)));
  }

  private static void updateImpactSeverityAndStandardSeverityIfTypeMatch(RuleUpdate update, RuleDto rule) {
    Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> impacts = update.getImpactSeverities();
    if (impacts.isEmpty()) {
      throw new IllegalArgumentException("Impacts are is missing");
    }
    impacts.forEach((key, value) -> rule.getDefaultImpacts()
      .stream()
      .filter(i -> i.getSoftwareQuality() == key)
      .findFirst()
      .ifPresent(i -> {
        i.setSeverity(value);
        if (RuleTypeMapper.toRuleType(convertToRuleType(key)) == RuleType.fromDbConstant(rule.getType())) {
          rule.setSeverity(convertToDeprecatedSeverity(value));
        }
      }));
  }

  private static void updateName(RuleUpdate update, RuleDto rule) {
    String name = update.getName();
    if (isNullOrEmpty(name)) {
      throw new IllegalArgumentException("The name is missing");
    }

View on GitHub (pinned to 184c821202)